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METHOD AND SYSTEM FOR RECORDING AND 
REPLAYING INTERNET TRANSACTIONS 

TECHNICAL FIELD 

5 This invention relates to the field of computer networks, and, more particularly, to 

the recording and replaying of transactions between an Internet client and the Internet. 

BACKGROUND OF THE INVENTION 
An Internet transaction includes steps that a computer user performs to 
communicate with an Internet server to perform a task, such as reading E-mail, or purchasing 
10 airline tickets. There are various applications for which it is useful to record an Internet 
transaction, and to replay it in the future, for such purposes as service monitoring and 
performance analysis. For example, companies that use web sites to advertise and sell 
merchandise may wish to monitor the performance of their web sites for such factors as response 
time, speed of downloading, etc., in order to ensure that the web site provides customers and 
15 potential customers with a pleasurable shopping or browsing experience. Because the 

performance of a web site, as perceived by an Internet user, depends greatly on the location 
within the Internet from which the user accesses the site, it is useful to obtain an average 
performance by analyzing the performance of a given transaction performed at various locations. 
One way to gather such data is to record an Internet transaction and then to replay it on different 
20 client machines throughout the world. 

Existing transaction recorder technology generally relies on an Internet client, 
such as a web browser, to send the recorder information about transactions performed with the 
client. In other words, the recorder never sees the exact communication being sent over the 
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Internet by the client, but rather receives a report from the client as to what occurred in the 
transaction. This approach presents drawbacks: First, the detail and accuracy of the record 
created is limited by what the client communicates to the recorder; second, the recorder may be 
dependent on either a particular browser, a particular protocol (such as HTTP, or FTP), or both. 
5 Replaying a transaction recorded under existing technology is necessarily limited by the level of 
detail recorded; for example, the particular Universal Record Locators (URLs) requested by the 
client may be replicated, but the time between requests, which may be relevant to the purpose for 
which the transaction is being replayed, may not be replicated if it has not been recorded. 
Moreover, existing transaction replayer technology does not generally permit the user to specify 
10 certain details of the manner of replaying a transaction, such as the speed at which 
communications will take place. 

In view of the foregoing, there is clearly a need for a system that overcomes the 
limitations of the prior art. 

SUMMARY OF THE INVENTION 

1 5 The present invention includes a recorder object, which is coupled between an 

Internet client, such as a web browser, and the Internet. During the recording process, the client 
is configured to point at the transaction recorder as its proxy server. The recorder object relays 
communications between the client and the Internet substantially unaltered, while recording the 
content of the communication. During a connection with the Internet, the recorder object is 

20 visible to the Internet as a client requesting services, and is visible to the client as a server 
providing the requested services. 
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An analysis module may interpret the record created by the recorder object. For 
example, certain URL requests by the Internet client may be interpreted as the following of a 
hyperlink on a web page previously received by the client. When a request for a URL is 
recorded by the recorder object, it is compared with URLs referenced in hyperlinks on the web 

5 page that the client received immediately prior to the request. If the URL appeared in one of the 
hyperlinks, for example the n-th hyperlink on the page, then the URL request is interpreted as the 
user following the n-th hyperlink on the page rather than as a request for the particular URL, and 
can be replayed accordingly. Recognizing and replicating the action of following hyperlinks 
permits a transaction to be replayed in a manner that more accurately reflects the way that a true 

1 0 user would use the Internet. 

The recorder object records details of the transaction, such as the duration of a 
communication, the time between communication events, the sizes of packets used in 
communications, and the DNS resolution time of a URL. This information can be used to 
replicate particular aspects of the transaction, such as the time between URL requests, and the 

1 5 speed at which information is transmitted by the client to the Internet. The transaction replayer 
can also regulate these quantities at the direction of an operator of the system. 

The invention also contemplates the use of a transaction replayer, which interprets 
the record generated by the recorder and executes the recorded steps. These steps include 
opening and closing connections and sending requests. The steps may be replayed in real time, 

20 or slowed down to simulate a slow connection. The replayer also analyzes responses to requests, 
compares responses with responses received during recording of the transactions and measures 
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the duration and size of requests and responses. 

Other features of the invention are described below. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The foregoing summary, as well as the following detailed description of the 
preferred embodiments, is better understood when read in conjunction with the appended 
drawings. For the purpose of illustrating the invention, there is shown in the drawings exemplary 
constructions of the invention; however, the invention is not limited to the specific methods and 
instrumentalities disclosed. In the drawings: 

Figure 1 is a diagram representing a computer system in which aspects of the 

invention may be incorporated; 

Figure 2 is a diagram of an exemplary network structure in which aspects of the 

invention may be incorporated; 

Figure 3 is a diagram of an exemplary structure the Internet network, in which 
aspects of the invention may be incorporated; 

Figure 4 shows an example display of a network client, with which aspects of the 

invention may be used; 

Figure 5 is a block diagram showing a proxy server coupled between a web 

browser and the Internet; 

Figure 6 shows a dialog box used for setting the connections of an Internet client 
for use with an aspect of the invention; 

Figure 7 shows a dialog box used for configuring the proxy server settings of an 
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Internet client for use with an aspect of the invention; 

Figure 7A shows a dialog box used for configuring the listening port and proxy 
server parameters of an example recorder object in accordance with an aspect of the invention; 

Figure 7B shows an example connection structure, in which a recorder object is 
inserted into the connection between a network client and a network that have been separated by 
a firewall; 

Figure 8 is a block diagram showing the operation of an Internet transaction 
recorder in accordance with an aspect of the invention; 

Figure 9 shows a sample web page with hyperlinks for use with an aspect of the 

invention. 

Figure 10 is a flowchart illustrating the use of a transaction recorder in accordance 

with an aspect of the invention; 

Figure 1 1 is a block diagram showing a transaction replayer that uses the 

recording created by a transaction recorder; 

Figure 12 is a flowchart illustrating the use of a transaction replayer in accordance 

with an aspect of the invention. 

DETAILED DESCRIPTION OF THE INVENTION 

Overview 

The breadth of the Internet and its global reach makes it possible for computer 
users to engage in transactions with computers in all parts of the world. Due to the global nature 
of the Internet and its complexity, the quality of a connection to an Internet site often depends on 
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where the connecting computer is located and how it is connected to the Internet. In order to 
evaluate the performance of a web site, it is useful to record an Internet transaction with an 
Internet destination and to replay the transaction on several computers connected to the Internet 
at diverse locations. A personal computer may be used to engage in, and record, an Internet 
5 transaction with a remote computer, and the recording may be used by another computer to 
replay the transaction. 
Computer Environment 

Figure 1 and the following discussion are intended to provide a brief general 
description of a suitable computing environment in which the invention may be implemented. 

10 Although not required, the invention will be described in the general context of computer- 
executable instructions, such as program modules, being executed by a computer, such as a client 
workstation or a server. Generally, program modules include routines, programs, objects, 
components, data structures and the like that perform particular tasks or implement particular 
abstract data types. Moreover, those skilled in the art will appreciate that the invention may be 

15 practiced with other computer system configurations, including hand-held devices, multi- 
processor systems, microprocessor-based or programmable consumer electronics, network PCs, 
minicomputers, mainframe computers and the like. The invention may also be practiced in 
distributed computing environments where tasks are performed by remote processing devices 
that are linked through a communications network. In a distributed computing environment, 

20 program modules may be located in both local and remote memory storage devices. 

As shown in Fig. 1, an exemplary system for implementing the invention includes 
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a general purpose computing device in the form of a conventional personal computer 20 or the 

like, including a processing unit 21, a system memory 22, and a system bus 23 that couples 
various system components including the system memory to the processing unit 21. The system 
bus 23 may be any of several types of bus structures including a memory bus or memory 
5 controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The 
system memory includes read-only memory (ROM) 24 and random access memory (RAM) 25. 
A basic input/output system 26 (BIOS), containing the basic routines that help to transfer 
information between elements within the personal computer 20, such as during start-up, is stored 
in ROM 24, The personal computer 20 may further include a hard disk drive 27 for reading from 

10 and writing to a hard disk, not shown, a magnetic disk drive 28 for reading from or writing to a 
removable magnetic disk 29, and an optical disk drive 30 for reading from or writing to a 
removable optical disk 3 1 such as a CD-ROM or other optical media. The hard disk drive 27, 
magnetic disk drive 28, and optical disk drive 30 are connected to the system bus 23 by a hard 
disk drive interface 32, a magnetic disk drive interface 33, and an optical drive interface 34, 

15 respectively. The drives and their associated computer-readable media provide non-volatile 
storage of computer readable instructions, data structures, program modules and other data for 
the personal computer 20. Although the exemplary environment described herein employs a hard 
disk, a removable magnetic disk 29 and a removable optical disk 3 1, it should be appreciated by 
those skilled in the art that other types of computer readable media which can store data that is 

20 accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, 
Bernoulli cartridges, random access memories (RAMs), read-only memories (ROMs) and the 
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like may also be used in the exemplary operating environment. 

A number of program modules may be stored on the hard disk, magnetic disk 29, 
optical disk 31, ROM 24 or RAM 25, including an operating system 35, one or more application 
programs 36, other program modules 37, program data 38, a transaction recorder 71 , and a 
5 transaction replayer 72. A user may enter commands and information into the personal computer 
20 through input devices such as a keyboard 40 and pointing device 42. Other input devices (not 
shown) may include a microphone, joystick, game pad, satellite disk, scanner or the like. These 
and other input devices are often connected to the processing unit 21 through a serial port 
interface 46 that is coupled to the system bus, but may be connected by other interfaces, such as a 
10 parallel port, game port, universal serial bus (USB), or a 1394 high-speed serial port. A monitor 
47 or other type of display device is also connected to the system bus 23 via an interface, such as 
a video adapter 48. In addition to the monitor 47, personal computers typically include other 
peripheral output devices (not shown), such as speakers and printers. 

The personal computer 20 may operate in a networked environment using logical 
15 connections to one or more remote computers, such as a remote computer 49. The remote 

computer 49 may be another personal computer, a server, a router, a network PC, a peer device 
or other common network node, and typically includes many or all of the elements described 
above relative to the personal computer 20, although only a memory storage device 50 has been 
illustrated in Fig. 1. The logical connections depicted in Fig. 1 include a local area network 
20 (LAN) 5 1 and a wide area network (WAN) 52. Such networking environments are commonplace 
in offices, enterprise-wide computer networks, Intranets and the Internet. 
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When used in a LAN networking environment, the personal computer 20 is 
connected to the local network 51 through a network interface or adapter 53. When used in a 
WAN networking environment, the personal computer 20 typically includes a modem 54 or other 
means for establishing communications over the wide area network 52, such as the Internet. The 
5 modem 54, which may be internal or external, is connected to the system bus 23 via the serial 
port interface 46. In a networked environment, program modules depicted relative to the personal 
computer 20, or portions thereof, may be stored in the remote memory storage device. It will be 
appreciated that the network connections shown are exemplary and other means of establishing a 
communications link between the computers may be used. 

10 Network Environment 

As noted, the computer described above can be deployed as part of a computer 
network. In general, the above description applies to both server computers and client computers 
deployed in a network environment. Figure 2 illustrates one such exemplary network 
environment in which aspects of the present invention may be employed. As shown in Fig. 2, a 

15 number of servers 10a, 10b, etc., are interconnected via a communications network 160 (which 
may be a LAN, WAN, intranet or the Internet) with a number of client computers 20a, 20b ? 20c, 
etc. In a network environment in which the communications network 160 is the Internet, for 
example, the servers 10 can be Web servers with which the clients 20 communicate via any of a 
number of known protocols such as hypertext transfer protocol (HTTP). Each client computer 

20 20 can be equipped with an Internet client, such as browser 180, to gain access to the servers 10. 
A server may be coupled to a database such as database 12 for providing information to a client. 
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Figure 3 shows an exemplary structure wherein a network, such as network 1 60, 

may be implemented as part of the Internet. Internet structure 160a includes numerous servers 
1 0a- 1 Oj (each designated with an "S") interconnected by high-speed connections 311-318. The 
high speed connections are of several different types: for example, connection 313 is a Tl 
5 connection, connection 3 15 is a high-speed fiber-optic connection, part of the so-called 
'"backbone" of the Internet, and connection 318 is a lower-speed ISDN connection. Internet 
structure 160a also includes numerous clients (each designated with a "C") connected to the 
servers. Most of the clients are connected to the Internet via an Internet Service Provider (ISP). 
For example, client 20a is connected to the Internet via ISP1 server 10a. 

10 ISPs are servers on the Internet and provide Internet access to individual 

subscribing clients. A subscribing client typically gains access to the Internet using a modem to 
call the ISP. The client typically dials a local telephone phone number to establish a connection 
to the Internet via the ISP by connecting to the ISP's point of presence (POP). A local area 
network (LAN) of clients can also be connected to the Internet, either via a dial-up connection or 

15 a permanent connection. For example, LAN 51a is connected to the Internet via one of the nodes 
lOd on LAN 51a that happens to be a server. 

In the example, server lOj is the server of a large bookstore that advertises and 
sells books over the Internet, for example by maintaining a web site. The customers of the 
bookstore access the Internet as clients 20a-20c. Customer clients 20a and 20c may, for 

20 example, be individuals who buy books and access the Internet from their respective homes in 
California and New York. The bookstore server lOj may, for example, be located in Illinois. 
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Internet Transaction Recorder 

The transaction recorder creates a record of a transaction between a user and the 
Internet, where the user engages in the transaction through a web browser, such as browser 180. 
A user engages in an Internet transaction by using browser 180 to request a series of web pages 
5 from the Internet. Figure 4 shows an exemplary visual interface of browser 180, as it might be 
displayed on a display device, such as monitor 47. A user begins the transaction by requesting a 
web page, such as web page 410. The visual interface of browser 1 80 displays web page 410 and 
shows the Universal Record Locator (URL) 401 of web page 410. Web page 410 displays 
information to the user, such as text 402 and graphics 403. Web page 410 also contains 

10 hyperlinks 41 1-413. A hyperlinks includes information to be displayed to the user, such as the 
text shown in hyperlinks 41 1-413, and also include the URL of a web page (not shown). By 
using a pointing device, such as mouse 42, a user may click on a hyperlink, which instructs 
browser 180 to retrieve from the Internet the web page referenced by the URL in the hyperlink 
and to display that web page to the user. For example, a user may follow hyperlink 412 by using 

15 mouse 42 to click on the text "White Pages" in hyperlink 412, thereby causing browser 180 to 
retrieve and display the web page referenced by the URL in hyperlink 412. The referenced web 
page could contain, for example, a directory of telephone numbers and E-mail addresses of 
people living in the user's geographic region, along with additional hyperlinks. In a typical 
session with browser 1 80, a user begins the transaction by requesting a web page. The user may 

20 then pause for a moment to read the information on the web page, and then follow a hyperlink on 
the web page. Retrieval of the web page referenced in the hyperlink may arrive as quickly as 
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permitted by the connection between browser 1 80 and the Internet; alternatively it may be 

delayed or received in pieces by web browser 180, due to a high volume of traffic on the Internet. 
The final request for a web page or following of a hyperlink marks the end of the transaction. 
As described more fully below, a transaction recorder creates a record of the series of requests, 
5 pauses, and connection delays that take place between the beginning and end of the transaction. 

A transaction recorder in accordance with the present inventions is like a proxy 
server that serves as a bridge between web browser 1 80 and the Internet, relaying 
communications between the browser and the Internet while recording the communications. 
Figure 5 shows a proxy server 502 in use with web browser 180. Proxy server 502 may be a 

10 dedicated machine serving as a firewall or an ISP, or it may be a transaction recorder running on 
the same computer 20 as web browser 180. Web browser 180 is configured to direct all outgoing 
communications destined for the Internet 160a, such as requests for web pages, to proxy server 
502 through its proxy server interface 501. Web browser 180 is also configured to receive all 
incoming communications, such as retrieved web pages, from proxy server 502 through proxy 

15 server interface 501. When web browser 180 opens a connection to proxy server 502, the proxy 
server opens a corresponding connection to server 10a, which is part of the Internet 160a. When 
web browser 1 80 sends a request for a web page to proxy server 502, the proxy server forwards 
the request to the Internet 160a via server 10a. When web browser 180 closes the connection to 
proxy server 502, the proxy server closes the corresponding connection to server 10a. 

20 In order to permit a user to configure web browser 1 80 for use with a proxy 

server, such as the disclosed recorder, web browser 180 provides a series of dialog boxes through 
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which a user may instruct web browser 180 to use a proxy server and may provide information 
identifying the location of the proxy server. Web browser 180 has an Internet options dialog box 
600, whereby a user may configure various aspects of web browser 180. A user configures web 
browser 180 through dialog box 600 by using an input device, such as keyboard 40 or mouse 42, 
5 One section of dialog box 600 is a connections section, which the user can view by using mouse 
42 to click on tab 601 in the example shown. The connections section permits the user to 
configure various features of web browser 180 pertaining to the connection between web browser 
180 and the Internet, such as the dial-up settings 603, and local area network settings 604. The 
connections section includes a button 602 marked; by using mouse 42 to click on button 602, the 
10 user is able to configure the local area network settings of web browser 180, including the proxy 
server settings. 

Figure 7 shows the dialog box 700 that is displayed to the user after the user 
clicks on button 602. Dialog box 700 includes a check box 701; by using mouse 42 to click on 
check box 701, the user can configure web browser 1 80 to use a proxy server. The user also uses 

15 keyboard 40 to enter the address and port of the proxy server into boxes 702 and 703, 
respectively. An example address could be either the name of the computer (e.g. 
"TheProxyServer") or an IP address (e.g. 123.123.123.123). Ports are 16 bit numbers; the HTTP 
protocol typically uses port 80. If a recorder object running on the same computer 20 as browser 
180 is to be used as the proxy server for browser 180, the address and port of the proxy server 

20 could be set to "127.0.0.1:80" ("127.0.0.1" is the address of the local machine, and "80" is the 
port). After entering the information, the user clicks button 704 to complete the process of 
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configuring web browser 180 to use a proxy server. 

Alternatively, if browser 180 is able to read the Internet settings from a file, then 
the recorder object may configure web browser 1 80 without operator intervention by changing 
the settings contained in the file. In the case of the MICROSOFT WINDOWS operating 

5 system(e.g. ? WINDOWS 95/98/NT), the Internet browser (e.g., MICROSOFT INTERNET 
EXPLORER) could store its settings in the registry. The recorder object could write the address 
of a network card used to access the recorder object directly in the registry using the registry 
Application Programming Interfaces (APIs) provided by the MICROSOFT WINDOWS 
operating system. For example, where browser 180 is an instance of the MICROSOFT 

10 INTERNET EXPLORER browser running on the same machine as the recorder object in a 

MICROSOFT WINDOWS operating system environment, the recorder object could change the 
registry setting 

"SOFTWAREMicrosoft/Windows/Cura^ to 
"localhost:80" or "127.0.0.1:80." Prior to making the change, the recorder object would save the 
15 original setting so that it can be restored to the registry when the recorder object terminates 
operation. 

The recorder object may also be configurable to work together with a browser 
180 that has been configured to use the recorder object as its proxy sever. As depicted in Figure 
7 A; an example recorder object in accordance with the invention may be a software application 
20 having a dialog box 710, in which the operator of the recorder object may configure the recorder 
object's parameters. Dialog box 710 includes a space 71 1 in which the operator may set the 
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"listening port" - that is, the port on which the recorder can expect to receive communication 

from browser 180. In the preceding example, the proxy server of browser 180 has been set to 
"localhost:80"; in Fig. 7 A, the operator of an example recorder object has set the listening port to 
"80," which corresponds to the port of the proxy server setting in the preceding example, 
5 Dialog box 710 also includes a second space 712, in which the operator may 

designate a proxy server for the recorder object to use for communication with a network, such as 
the Internet. The computer 20 on which browser 180 and the recorder object are running may be 
behind a firewall (i.e., on an Intranet), and the proxy server settings of browser 180 may have 
been set (prior to invoking the recorder object) to point to a server machine that implements the 

10 firewall. For example, where the recorder object has saved the proxy server settings from the 
MICROSOFT WINDOWS operating system registry, the saved settings may point to a firewall 
server machine. The recorder object can then be configured to use the server machine as its proxy 
server, for example by an operator's entering the address of the server machine in space 712; 
alternatively, the recorder object may be able to set the proxy server parameter without operator 

15 intervention if it knows the address of the server machine (e.g., if it has retrieved the address 
from the registry). Figure 7B shows an example connection structure incorporating a recorder 
object 71. Browser 180 was originally configured to access the Internet 160, using firewall 
server 502 as its proxy server. After the parameter changes described above in the text 
accompanying Figs. 7 and 7A have been made, browser 180 points to recorder object 71 as its 

20 proxy server, and recorder object 71, in turn, points to firewall server 502 as its proxy server. 
Thus communications are able to pass from browser 180, to recorder object 71, to proxy server 
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502, to the Internet 160. 

Figure 8 shows the use of a recorder object coupled to a browser by way of a 
proxy server interface in accordance with the present invention. Recorder object 71 is preferably 
a process running on the same computer 20 as web browser 180. Recorder object 71 is coupled 
5 between web browser 1 80 and Internet server 1 0a and acts as a proxy server for browser 1 80. 
Recorder object 71 has a client interface 808, and browser 180 has a proxy server interface 801. 
The client interface 808 of recorder object 71 makes a connection 802 to the proxy server 
interface of browser 1 80. Connection 802 may comprise any form of interprocess 
communication that permits two application processes to communicate information to each 

10 other. Alternatively, if recorder object 71 is running on a different computer from web browser 
180, then connection 802 may comprise the connections depicted in Fig. 3, such as an Ethernet 
connection, Tl connection 313, fiber-optic connection 315, or ISDN connection 318. Recorder 
object 71 also has an Internet interface 809, through which recorder object 71 connects to 
Internet server 10a through connection 806, Connection 806 comprises connections such as 

15 those depicted in Fig. 3, such as connections 313, 315, and 318. 

Browser 180 sends a communication destined for the Internet 160a, such as a 
request for a web page located at web site 803, to recorder object 71 over connection 802 through 
proxy server interface 801. Recorder object 71 receives the communication through client 
interface 808. Recorder object 71 relays the communication to the Internet 160a over connection 

20 806 through Internet interface 809. While relaying the communication from web browser 1 80 to 
the Internet, recorder object 71 creates a record 804 of the communication. The record includes 
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the URL of the web page requested by browser 180, and may also include additional information 
such as: the duration of a communication, the sizes of packets 707 used in communications, the 
DNS resolution time of the URL, and the time between various communication events. As 
described more fully below, this information may be used in a transaction replayer to replicate 
5 some aspects of the transaction. 

Recorder object 71 also receives communications from the Internet 160a destined 
for browser 1 80, such as the content of a web page requested. Recorder object 71 relays these 
communications to browser 160a, and may, optionally, record information about these 
communications, such as the content of the communication, the duration of the communication, 

10 and the time since the most recent communication from client 401 to the Internet. 

One purpose of recorder object 71 is to observe and record an Internet transaction 
as it would otherwise have taken place in the absence of recorder object 71. To avoid affecting 
the transaction, recorder object 71, to the extent possible, does not interfere with communication 
between web browser 180 and to an Internet destination, such as web site 803, and, therefore, 

15 relays communications between web browser 71 and the Internet 160a without any substantial 
modification to their contents. Preferably, recorder object 71 relays communications without any 
content modification. 

Recorder object 71 may also be associated with an analysis module 805, which is 
a software module that may be a component of recorder object 71 . Analysis module 805 

20 interprets communications between browser 401 and the Internet, and may modify the record to 
reflect its interpretation. One function of analysis module 805 is to draw inferences about the 
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context of some communications from web browser 180, in order to permit a transaction replayer 

(not shown) to simulate a user transaction more accurately. For example, one communication 
from browser 180 may be a request to retrieve a web page 410a located at a specified URL; web 
page 800 is depicted in Fig. 8. Web page 410a may contain hyperlinks 41 la-41 lc to other web 
5 pages identified by their URLs 401a-401c. The user operating browser 1 80 may issue a 
command to follow one of the hyperlinks, such as hyperlink 411b; this command will be 
observed and recorded by recorder object 501 only as a request for a the web page located at 
URL 401b. Analysis module 805 compares the URL 401b with the URLs referenced in the 
hyperlinks 41 la-41 lc in web page 410a. Because URL 401b appears among hyperlinks 411a- 

10 41 lc, analysis module 805 concludes that browser 180 requested the web page at URL 401b as a 
result of following hyperlink 41 lb on web page 410a. This information can be entered in the 
record by recording the request for the web page at URL 401b as the following of the second 
hyperlink on web page 410a; alternatively, the record may initially contain the URL referenced 
in the followed hyperlink and can be modified later by analysis module 805 to reflect the 

1 5 following of the second hyperlink on web page 41 0a. The position of a hyperlink among all 

hyperlinks on a web page is defined as the hyperlink's ordinal position; for example, in web page 
410a, the ordinal position of hyperlink 41 la is first, of 41 lb is second, etc. Recording the 
request for a web page as the following of a hyperlink permits a transaction replayer making use 
of the record to simulate more accurately a user Internet session, in which a user follows 

20 hyperlinks on web pages rather than merely requesting a series of unrelated web pages. 
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Example Use of Transaction Recorder 

Figure 10 is a flowchart showing the steps by which recorder object 71 operates in 
accordance with the present invention. Recorder object 71 starts at step 1001, running along a 
first execution thread, labeled "Thread 1" in Fig. 10. At step 1002, the recorder object creates a 

5 file in which to store the record of recorded transactions. At step 1003, the settings of browser 
180 are set to point to recorder object 71 as a proxy server for browser 1 80, which configures 
browser 180 to communicate with recorder object 71 as its proxy server. At step 1004, the 
recorder object waits for browser 180 to request a connection to the Internet. After a connection 
is requested, the connection is either accepted or rejected at step 1005. If the connection is 

10 rejected, the flow returns to step 1004, where recorder object 71 waits for another connection 
request. If the connection is accepted at step 1005, a new thread, labeled "Thread n" in Fig. 10, 
is created at step 1006 to record the connection. "Thread 1," which runs asynchronously with 
respect to "Thread n," returns to step 1004 to wait for another connection request. Step 1006 
creates a separate instance of "Thread n" for each Internet connection successfully made at step 

15 1005, so that recorder object 71 can use a separate thread to monitor each connection. 

An instance of "Thread n" begins executing at step 1007. At step 1009, recorder 
object 1001 receives from browser 180 a request for a web page located at a specific URL. Also 
at step 1009, recorder object 71 logs the request for the URL into the record 804. It is 
determined at step 1010 whether a connection needs to be made to an Internet server. If a 

20 connection is open, the flow proceeds to step 1013, otherwise, a connection is opened at step 
1011, and the IP address of the server to which to connect is also retrieved if not already given. 
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At step 1012, the connection either succeeds, in which case the flow proceeds to step 1013, or 
fails, in which case execution of "Thread n" stops. At step 1013, recorder object 71 forwards the 
URL request received at step 1009 to an Internet server. At step 1014, recorder object 71 waits 
for the response, which, for example, is the web page located at the specified URL. At step 
5 1015, recorder object 71 records the response and any cookie into the record 804, and relays the 
response and cookie to browser 180. The flow then returns to step 1009 to receive the next URL 
request from browser 180. 
Transaction Replayer 

In accordance with an aspect of the invention, the record created by the recorder 

10 object 71 is created so that the recorded transaction can be replayed. A transaction replayer is a 
specially configured Internet client which uses the record created by recorder object 71 to 
generate communications to be sent over the Internet, thus simulating the recorded session. 

Figure 1 1 depicts the use of a transaction replayer. Transaction replayer 1101 is 
an Internet client connected to the Internet 160a through connection 1 102. Transaction replayer 

15 makes use of the record 804 created by the process depicted in Fig. 10, to replay a recorded 
transaction. For example, record 804 contains URLs requested during a browser session; 
transaction replayer 1101 can issue requests for those same URLs. Where analysis module 805 
has been used to infer which URL requests were made as the result of a user following 
hyperlinks, and the ordinal position of the followed hyperlink has been recorded, transaction 

20 player 1101 can carry out an instruction to follow the n-th hyperlink by examining the previous 
web page received, determining the URL referenced by the n-th hyperlink, and requesting the 
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web page located at that URL, where "n-th" denotes the ordinal position of the hyperlink to be 
followed. 

Additionally, when recorder object 71 records additional detail about the 
transaction, such as the duration of the communication, the sizes of packets 807 used in 
5 communications, the DNS resolution time of the URL, and the time between communication 
events, transaction replayer 1101 may use this information to replicate other aspects of the 
transaction, such as the time between URL requests, delays in transmission, the particular packet 
structure of the original recorded communication, etc. Additionally, transaction replayer 1101 
may be configured to simulate a connection that is slower than connection 1 102, by regulating 

10 the rate at which it sends communications over connection 1 102. The speed-regulated 
communication a slow connection over which recorder object 71 recorded the original 
transaction; or, the speed of the communication can be regulated at the request of an operator of 
the transaction replayer 1101, without regard to the speed at which the transaction was recorded. 

Figure 12 is a flowchart showing the processes by which the replayer simulates a 

1 5 user transaction by using the record 804 created by the transaction recorder. The replayer begins 
its main loop by starting at step 1201. At step 1202, the replayer makes a connection to an 
Internet server and initializes a pointer to point to the first item in record 804. The items in 
record 804 include URLs of web pages to be requested, and instructions to follow hyperlinks on 
prior web pages. At step 1203, the replayer gets an item from record 804 by looking up the item 

20 that is currently being addressed by the pointer; at the start of the replayer session, the pointer 
addresses the first item. At step 1204, the replayer evaluates whether the item is a request for a 
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specific URL. If the item is a request for a specific URL, then the replayer proceeds directly to 

step 1207 to process the URL; if the item is an instruction to follow a hyperlink rather than a 
specific URL, then the replayer looks up the hyperlink on the most recent web page, which is 
stored in the log 1220 of the replayer session. Log 1220, which is created during the replayer 
5 session and contains historical information about the session, is discussed below. After 

determining the URL referenced in the hyperlink to be followed, the replayer proceeds to the 
processing routine, which begins at step 1207. 

The processing routine first receives two time parameters to be used in 
transmitting the URL request. First, at step 1207, the routine looks in record 804 for timing 

10 information that was recorded by recorder object 71, such as the time between the prior URL 
request and the current one. This timing information is used to simulate the pace at which a user 
would request a sequence of web pages, as a user typically requests a web page, pauses to read 
the page, and then requests the next page some time later. Second, at step 1208, the replayer 
receives instructions as to the speed at which the request is to be transmitted. For example, if the 

15 replayer is connected to the Internet via a fast Tl connection, it can simulate a slow dial-up 
connection by transmitting the request at a typical dial-up line speed, such as 14 or 28 kilobits 
per second. The speed instructions may come from various sources, such as a user operating the 
replayer or from record 804. After receiving these time parameters, the replayer determines at 
step 1209 whether it is time to send the request, based on the information received at step 1207. 

20 If it is time to send the request, the replayer proceeds to step 121 1 to send the request to an 
Internet server; if it is not time to send the request, the replayer proceeds to step 1210 to wait 
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until it is time to send the request, and then proceeds to step 121 1 to send the request. At step 
121 1, the replayer sends the request to an Internet server, modifying the speed at which it sends 
the request as instructed in step 1208, and waits for a response. At step 1211, the replayer also 
enters into log 1220 the URL requested and information about the response, such as the contents 

5 of the web page received, hyperlinks on the received web page, speed at which the response was 
received, and the packet sizes of the response. Other information in log 1220 includes: DNS 
resolution times; connection times; time between a request and the beginning of a response; total 
time for each response; total transaction time; time between two specified points in the 
transaction; the header size of each response; the data size of each response; the total amount of 

10 data in each response; volume of data received between two specified points in a transaction; 
DNS resolution errors, TCP errors; protocol specific errors; and invalid response content errors. 

After logging information at step 1220, the flow returns from the processing 
routine to the main loop at step 1212. At step 1213, the record pointer is advanced to the next 
item. A determination is made at step 1213 as to whether the end of the record has been reached. 

15 If the end of the record has been reached, the replayer session terminates at step 1214. 

Otherwise, the replayer returns to step 1203 to retrieve and process the next item in the record. 

It is noted that the foregoing examples have been provided merely for the purpose 
of explanation and are in no way to be construed as limiting of the present invention. While the 
invention has been described with reference to preferred embodiments, it is understood that the 

20 words which have been used herein are words of description and illustration, rather than words of 
limitation. Further, although the invention has been described herein with reference to particular 
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means, materials and embodiments, the invention is not intended to be limited to the particulars 
disclosed herein; rather, the invention extends to all functionally equivalent structures, methods 
and uses, such as are within the scope of the appended claims. Those skilled in the art having the 
benefit of the teachings of this specification, may effect numerous modifications thereto and 
changes may be made without departing from the scope and spirit of the invention in its aspects. 
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CLAIMS 

WE CLAIM: 

1 . A method for recording network transactions, comprising the acts of: 

coupling to a client object by way of a proxy server interface of said client 

5 object; 

receiving a client request destined for said network; 

recording selected information indicative of said client request; and 

transmitting said client request onto said network. 

2. The method of claim 1, wherein said network comprises the Internet. 
10 3. The method of claim 1, wherein said client object comprises a browser. 

4. The method of claim 1, further comprising the act of simulating a user 
interaction by retransmitting said client request. 

5. The method of claiml, further comprising the acts of: 

receiving a response to said request from said network; and 
15 transmitting said response to said client object. 

6. The method of claim 5, further comprising the act of recording said response. 

7. The method of claim 5, further comprising the acts of: 

receiving a second client request destined for said network; 
transmitting said second client request onto said network; and 
20 recording selected information indicative of said second client request, 

wherein the recorded information indicative of said second client request is a function of said 
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response. 

8. The method of claim 7, wherein said response is a web page including a 
plurality of hyperlinks, and wherein said function takes into account the relative location of one 
of said hyperlinks on said web page, 
5 9. The method of claim 1 ? further comprising the acts of: 

receiving a second client request destined for said network; 
transmitting said second client request onto said network; and 
recording the time between the client requests. 

10. The method of claim 1 , wherein said acts are performed by a computer, and 
10 wherein said client object comprises a process running on said computer, 

1 1 . The method of claim 1 , wherein said transmitting act transmits the received 
client requests to said network without alteration. 

12. The method of claim 1, wherein the proxy server settings of said client object 
are located in a file, wherein said act of coupling comprises modifying said file. 

15 13. The method of claim 12, wherein said method is performed in a 

MICRCOSOFT WINDOWS operating system environment, and wherein said file comprises the 
MICROSOFT WINDOWS operating system registry. 

14. The method of claim 1, wherein said client object is configured to use a 
server machine as a proxy server, and wherein said act of transmitting comprises sending said 

20 client request to said server machine. 

15. A computer-readable medium containing computer-executable instructions to 
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perform the method of claim 1. 

16. A system for recording network transactions, comprising: 

a first interface couplable to a client object, whereby said interface receives requests destined for 
said network originating from said client object; 

a recorder object in communication with said first interface for receiving 
said requests by way of said first interface, and said recorder object creating a record comprising 
a representation of said requests; and 

a second interface couplable to said network, said second interface being 
in communication with said recorder object wherein said recorder object transmits said requests 
to said network by way of said second interface. 

17. The system of claim 16, wherein said network comprises the Internet. 

18. The system of claim 16, wherein said client object comprises a browser. 

19. The system of claim 16, wherein said second interface receives responses 
destined for said client object originating from said network, wherein said recorder object is in 
communication with said second interface for receiving said responses by way of said second 
interface, and wherein said first interface is in communication with said recorder object whereby 
said recorder object transmits said responses to said client object by way of said first interface. 

20. The system of claim 16, wherein said recorder object creates a record of said 

responses. 

21 . A method of simulating a user network transaction comprising the acts of: 

connecting to a network server; 
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retrieving a transaction item from a record of a network 

transaction, wherein said record was created from a prior recorded transaction; and 

sending a request to said network server, wherein the content of 
said request is based on said transaction item. 
5 22. The method of claim 21 , wherein said network comprises the Internet. 

23. The method of claim 22, wherein said transaction item comprises a 
representation of a Universal Record Locator of a web page to be retrieved from the Internet. 

24. The method of claim 21, further comprising the act of receiving, from said 
network, a response to said request. 

10 25 . The method of claim 24, further comprising the act of recording said 

response. 

26. The method of claim 24, further comprising the acts of; 

retrieving a second transaction item from said record, wherein said 
second transaction item comprises a reference to said response; and 
1 5 sending a second request to said network server, wherein the 

content of said request is based on data contained in said response. 

27. The method of claim 26, wherein said network comprises the Internet, 
wherein said response comprises a web page, and wherein said data comprises a Universal 
Record Locator referenced in a hyperlink on said web page. 

20 28. The method of claim 24, further comprising the acts of: 

inserting a time delay following the receipt of said response; 
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retrieving a second transaction item from said record; and 

sending a second request to a network server, wherein the content of said 
second request is based on said second transaction item. 

29. The method of claim 21, wherein said sending act is performed at a rate 
5 slower than the rate supported by the connection to said network server. 

30. The method of claim 29, wherein the rate is slowed by inserting a time delay 
between packets used to transmit said request. 

31. A computer-readable medium containing computer-executable instructions to 
perform the method of claim 21 . 

10 32. A method of simulating a user network transaction comprising the acts of: 

connecting to a network server; 

receiving a transaction item representing a communication to be 

sent over a network; and 

sending a request to said network server at a rate slower than the 
1 5 rate supported by the connection to said network server, wherein the content of said request is 
based on said transaction item. 

33. The method of claim 32, wherein said network comprises the Internet. 

34. The method of claim 32, further comprising the act of receiving, from said 
network, a response to said request. 

20 35. The method of claim 34, further comprising the acts of: 

inserting a time delay following the receipt of said response; 
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retrieving a second transaction item from said record; and 

sending a second request to a network server, wherein the content of said 

second request is based on said second transaction item. 

36. A computer-readable medium containing computer-executable instructions to 

perform the method of claim 32. 
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ABSTRACT 

A system for recording and replaying Internet transactions is disclosed. The 
system uses a recorder object that connects between the Internet and an Internet client through 
the Internet client's proxy server interface. All communications between the Internet client and 
5 the Internet pass through the recorder object, and the recorder object is therefore able to observe 
directly the exact content of the communications, as well as other aspects of the communications, 
such as the rate at which they take place, the number and size of packets into which they are 
bundled, errors in communication, and DNS resolution time. This information can be used to 
produce a detailed record of the transaction, which can then be reproduced by an Internet client 
10 which is configured to use the record to replay the recorded transaction. 
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of WOODCOCK WASHBURN KURTZ MACK3EWICZ & NORRIS LLP, One 

Liberty Place - 46 th Floor, Philadelphia, Pennsylvania 19103. 

Please address all telephone calls and correspondence to: 

Peter M. Ullman, Esquire 
WOODCOCK WASHBURN KURTZ 
MACKIEWICZ & NORRIS LLP 

One Liberty Place - 46 th Floor 
Philadelphia, PA 19103 
Telephone: (215) 568-3100 

I hereby declare that all statements made herein of my own knowledge are true and that 
all statements made on information and belief are believed to be true; and further that 
these statements were made with the knowledge that willful false statements and the like 
so made are punishable by fine or imprisonment, or both, under Section 1001 of Title 18 
of the United States Code and that such willful false statements may jeopardize the 
validity of the application or any patent issued thereon. 



Name: 

Jerome D. Boss 


Signature^ — — ^ * 


Date of Signature: It)- 
Citizenship: France 


Mailing Address: 

13550 NE 54 th Place 


City/State of Actual Residence 

Bellevue, WA 98005 



Docket No.: MSFT-0097/141 553.1 - 4 - 



PATENT 



7VT f% wft r\ • 

iName. 

Cezary Marcjan 


fn L 

Signature: ( QLlS^J VWCA^ 
Date of Signature: £0/ $ 

Citizenship: 

Poland 


Mailing Address: 

15916 NE 40 th Way 


City/State of Actual Residence 

Redmond, WA 98052 





Name: 

Ryan R. Hamlin 


Signature: ^ V.A 


Mailing Address: 

22604 NE 140 th Way 


Date of Signature: /°/$f fl 

Citizenship: 

U.S.A. 


City/State of Actual Residence 

Woodinville, WA 98072 





Name: 

Pierre P. Cote 


Signature-^xiK^ 


Date of Signature: \) 

Citizenship: 

Canada 


Mailing Address: 

16227 Northrup Way 
Unit B201 


City/State of Actual Residence 

Bellevue, WA 98008 
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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In Re Application of: 

Jerome D. Boss, Cezary Marcjan, 
Ryan R. Hamlin, Pierre P. Cote 

Group Art Unit: Not Yet 
Serial No. : Not Yet Assigned Assigned 

Filed: Herewith Examiner: Not Yet Assigned 

For: METHOD AND SYSTEM FOR 

RECORDING AND REPLAYING 
INTERNET TRANSACTIONS 



Assistant Commissioner for Patents 
Washington DC 20231 



Sir: 



ASSOCIATE POWER OF ATTORNEY 



The undersigned, of the firm WOODCOCK WASHBURN KURTZ 
MACKIEWICZ & NORRIS LLP, One Liberty Place - 46th Floor, Philadelphia, Pennsylvania 
19103, Attorney and/or Agents for Applicant(s), hereby appoints the following: 



Robert B. Washburn 
Richard E, Kurtz 
John J. Mackiewicz 
Norman L. Norris 
Albert W. Preston, Jr. 
Dale M. Heist 
Philip S. Johnson 
JohnW. Caldwell 
Gary H. Levin 
Dianne B. Elderkin 
Francis A. Paintin 
John P. Donohue, Jr. 
Henrik D. Parker 
Suzanne E. Miller 
Lynn B. Morreale 
Mark DeLuca 
Joseph Lucci 
Michael P. Dunnam 
Michael D. Stein 



Registration No. 16,574 
Registration No. 19,263 
Registration No. 19,709 
Registration No. 24,196 
Registration No. 25,366 
Registration No. 28,425 
Registration No. 27,200 
Registration No. 28,937 
Registration No. 28,734 
Registration No. 28,598 
Registration No. 19,386 
Registration No. 29,916 
Registration No. 31,863 
Registration No. 32,279 
Registration No. 32,842 
Registration No. 33,229 
Registration No. 33,307 
Registration No. 32,611 
Registration No. 34,734 



Albert J. Marcellino 
David R. Bailey 
Doreen Yatko Trujillo 
Barbara L. Mullin 
Kevin M. Flannery 
Lynn A. Malinoski 
Lori Y. Beardell 
Michael P. Straher 
David A. Cherry 
Anthony J. Rossi 
Michael J. Swope 
Michael J. Bonella 
Harold H. Fullmer 
William R. Richter 
John E. McGlyrm 
Kimberly R. Hild 
Lawrence A. Aaronson 
Jonathan M. Waldman 
Paul K. Legaard 



Registration No. 34,664 
Registration No. 35,057 
Registration No. 35,719 
Registration No. 38,250 
Registration No. 35,871 
Registration No. 38,788 
Registration No. 34,293 
Registration No. 38,325 
Registration No. 35,099 
Registration No. 24,053 
Registration No. 38,041 
Registration No. 41,628 
Registration No. 42,560 
Registration No. 43,879 
Registration No. 42,863 
Registration No. 39,224 
Registration No. 38,369 
Registration No. 40,861 
Registration No. 38,534 
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Chad Ziegler 
David N. Farsiou 
Maureen Gibbons 
Steven H. Meyer 
Joseph R. Condo 
Michael K. Jones 
Frank T. Carroll 
Hans J. Crosby 
Rena Patel 
Mark J. Rosen 
Mitchell R. Brustein 
Thomas E. Watson 
Gregory L. Hillyer 



Registration No. 44,273 
Registration No. 44,104 
Registration No. 44,121 
Registration No. 37,189 
Registration No. 42,43 1 
Registration No. 4 1 , 1 00 
Registration No. 42,392 
Registration No. P44,634 
Registration No. 41,412 
Registration No. 39,822 
Registration No. 38,394 
Registration No. 43,243 
Registration No. 44,154 



S. Maurice Valla 
Vincent J. Roccia 
Robin S. Quartin 



Registration No. 43,966 
Registration No. 43,887 
Registration No. P45,028 



Maria M. Kourtakis Registration No. 41 ,126 
Richard B. LeBlanc Registration No. 39,495 

his/her associates with full power to prosecute the above-identified application and to transact 
all business in the Patent Office connected therewith and requests that correspondence 
continue to be directed to the firm of WOODCOCK WASHBURN KURTZ MACKIEWICZ 
& NORMS LLP at the above address. f\ a ^ 



Woodcock Washburn Kurtz 
Mackiewicz & Norris LLP 
One Liberty Place - 46th Floor 
Philadelphia PA 19103 
Telephone: (215) 568-3100 
Facsimile: (215) 568-3439 





Peter M. Ullman 
Registration No. 43,963 



